CVE-2021-3712: Out-of-bounds Read

August 24, 2021 (updated November 9, 2023)

If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext)

References

nvd.nist.gov/vuln/detail/CVE-2021-3712
www.openssl.org/news/secadv/20210824.txt

Code Behaviors & Features

Detect and mitigate CVE-2021-3712 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →